OilRig

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this techn

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: Trend

Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Cit

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversar

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executa

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of intera

Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help syst

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by use

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web bro

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with exi

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from an

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries dete

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operation

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The d

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable c

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify t

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

BONDUPDATER is a PowerShell backdoor used by OilRig. It was first

Helminth is a backdoor that has at least two variants - one written in VBScript and PowerShell that is deli

ISMInjector is a Trojan used to install another OilRig backdoor, I

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modul

Mango is a first-stage backdoor written in C#/.NET that was used by [OilRig](https://attack.mitre.org/group

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

.

ODAgent is a C#/.NET downloader that has been used by OilRig since

OilBooster is a downloader written in Microsoft Visual C/C++ that has been used by [OilRig](https://attack.

OilCheck is a C#/.NET downloader that has been used by OilRig sinc

OopsIE is a Trojan used by OilRig to remotely execute commands as

POWRUNER is a PowerShell script that sends and receives commands to and from the C2 server. (Citation: Fire

PowerExchange is a PowerShell backdoor that has been used by [OilRig](https://attack.mitre.org/groups/G0049

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

QUADAGENT is a PowerShell backdoor used by OilRig. (Citation: Unit

RDAT is a backdoor used by the suspected Iranian threat group [OilRig](https://attack.mitre.org/groups/G004

RGDoor is a malicious Internet Information Services (IIS) backdoor developed in the C++ language. [RGDoor](

Reg is a Windows utility used to interact with the Windows Registry. It can be used at the command-line int

SEASHARPEE is a Web shell that has been used by OilRig. (Citation:

SampleCheck5000 is a downloader with multiple variants that was used by [OilRig](https://attack.mitre.org/g

SideTwist is a C-based backdoor that has been used by OilRig since

Solar is a C#/.NET backdoor that was used by OilRig during the [Ou

Systeminfo is a Windows utility that can be used to gather detailed information about a computer. (Citation

The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all task

ZeroCleare is a wiper malware that has been used in conjunction with the [RawDisk](https://attack.mitre.org

certutil is a command-line utility that can be used to obtain certificate authority information and configu

ftp is a utility commonly available with operating systems to transfer information over the File Transfer P

ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and

netstat is an operating system utility that displays active TCP connections, listening ports, and network s

Juicy Mix was a campaign conducted by OilRig throughout 2022 that

Outer Space was a campaign conducted by OilRig throughout 2021 th